socfortress/waf-platform-public v1.0.23 on GitHub

What's new: fix false positives from the log viewer

When the WAF blocks a legitimate request, you can now exclude exactly what caused it, without disabling the rule or lowering the paranoia level.

See what matched. Click a blocked or detected request in Logs. Each matched rule shows the parameter it matched (for example ARGS:q), the text that triggered it, and how many points it added to the anomaly score.
Tune… in one click. The dialog starts with the narrowest fix: this parameter, on this path, on this site. Broader options are one click away. You can also limit an exclusion to some HTTP methods, or use a "starts with" or regex path.
Check the impact first. Before saving, the dialog estimates the effect on the last 1–30 days of logged traffic: how many requests the exclusion touches, how many blocked ones would have passed, sample requests, and the exact SecLang it generates.
Manage them in one place. The new Rules → Exclusions tab lists every exclusion with its reason. From there you can disable, edit or delete one, or jump to the request it was created from. Sites with their own exclusions show a count in the Sites list.
Works on every rule: OWASP CRS rules, the built-in SQL injection / XSS rules (9000001 / 9000002), the API Security ruleset, and your custom rules.
Audited: every change is recorded in the audit log, including the generated directive.

The User Guide has a new Exclusions (False Positives) section.

Existing per-rule exclusions are migrated automatically. Each comma-separated entry becomes its own all-sites exclusion. In earlier versions, an entry such as ARGS:a,ARGS:b only excluded the first variable, and it made the rule inspect the second one too. After upgrading, both are excluded as intended.
API users: the new endpoints are /api/v1/rules/exclusions (plus /preview) and GET /api/v1/logs/{id}/tuning. The old POST /api/v1/rules/crs/{id}/exclusion still works.
Paths are normalised before matching, so an exclusion for /search can't be reached through /search/../admin.
The impact estimate only covers requests that were logged. It assumes default CRS scores and the site's current threshold.
The upgrade adds a database table. It is created automatically when the admin API starts.

docker compose pull
docker compose up -d

latest points to this release. If you pin versions, set WAF_IMAGE_TAG=1.0.23 (no v prefix) before pulling.

Images: ghcr.io/socfortress/waf-caddy:1.0.23, ghcr.io/socfortress/waf-admin-api:1.0.23, ghcr.io/socfortress/waf-admin-ui:1.0.23